ThreatModeler Nexus

ThreatModeler Nexus is a threat-modeling platform for organizations managing security across applications, cloud and hybrid environments, devices, and operational technology. It suits enterprise security, architecture, development, compliance, and risk teams that need one governed view of many systems. Its breadth is valuable for portfolio oversight, but the paid license requires a 12-month contract and AWS infrastructure may add cost.

Overview

Nexus uses the Secure Design Graph as a shared record for architectures, threats, controls, compliance requirements, and security decisions. That makes it possible to connect work across a large application and infrastructure portfolio instead of keeping isolated diagrams. The approach is more appropriate for organizations building a repeatable governance program than for a small team wanting a single lightweight model.

ThreatModeler was founded in 2010 and is headquartered in Jersey City, New Jersey. The product supports web and API access and can be deployed self-hosted. ThreatModeler lists ISO 27001:2022 and SOC 2 Type II certifications, and announced FedRAMP Moderate authorization for Nexus in September 2026.

Key features

Modeling and risk analysis

Nexus supports STRIDE, PASTA, and CSA MAESTRO for agentic systems, plus multiple modeling methods, templates, and frameworks. Attack-path analysis helps trace how weaknesses can combine, while risk prioritization focuses attention on the issues most consequential to the organization. The Secure Design Graph includes more than 1,500 catalogued threats and over 3,500 security requirements, giving teams a substantial starting library rather than requiring every control to be authored from scratch.

Agents and developer workflow

System Mapping, Graph, and Reporting agents operate on the shared graph. The built-in MCP Server checks pull requests and commits against the current threat model, then returns threats, requirements, and mitigations inside the development workflow. That is a strong fit for teams that want design decisions to remain relevant as code changes. Customers can connect their own AI model, while Nexus's deterministic framework governs the resulting output.

Integrations and compliance

Integrations cover Terraform, AWS CloudFormation, Azure ARM Templates, GitHub Actions, Azure DevOps, Jenkins, AWS, Google Cloud, Microsoft Azure, Bitbucket, ServiceNow, and ArmorCode. Findings map to more than 180 regulatory and security frameworks, including NIST, ISO 27001, PCI DSS, HIPAA, DORA, and the EU AI Act. That breadth is useful where one portfolio must satisfy several regimes, though teams with only one narrow compliance target may not need the full scope.

Pricing

Community Edition

The Community Edition costs nothing and is aimed at practitioners, students, developers, architects, and security teams wanting to experience threat modeling before scaling. It is the sensible entry point for evaluation or learning, but it does not provide the commercial licensing described for larger deployments.

ThreatModeler license

The ThreatModeler license costs $4,000 a year, billed on a 12-month contract, with a single LICENSE dimension. Additional AWS infrastructure costs may apply. This is aimed at organizations prepared to budget for governed, portfolio-level use; the annual commitment is a significant drawback for teams with uncertain adoption or short projects. Pricing is custom for plans without a published amount.

Platforms

Nexus is offered through web and API interfaces, with self-hosted deployment also supported. That combination gives platform teams a choice between managed access and greater control over where the system runs. AWS infrastructure charges should be included in any self-hosted or deployment-cost assessment where they apply.

Who it's for

Nexus is built for enterprise security, architecture, development, compliance, and risk teams operating across large portfolios. It is particularly well matched to organizations that need threat models tied to infrastructure-as-code, CI workflows, regulatory mappings, and centrally governed AI-assisted analysis. A small project team, or a user seeking only a free open-source diagramming utility, is likely to find the platform's governance emphasis and annual commercial term excessive.

Pros and cons

• Pros: A single Secure Design Graph connects architecture, threats, controls, compliance, and decisions across portfolios.
• Pros: MCP pull-request and commit checks bring threat-model guidance into developer workflows.
• Pros: STRIDE, PASTA, and CSA MAESTRO support, extensive libraries, attack-path analysis, and risk prioritization cover both established and agentic-system programs.
• Pros: More than 180 compliance mappings and FedRAMP Moderate authorization serve regulated environments.
• Cons: The commercial license is $4,000 a year on a 12-month contract, limiting flexibility.
• Cons: AWS infrastructure costs may be additional, complicating the total deployment budget.
• Cons: Support commitments differ: 99.5% monthly uptime for Standard Support versus 99.9% for Enterprise, and support covers only the current and immediately preceding major versions.

Alternatives

Choose CAIRIS when a free Apache-licensed tool with web, API, desktop, and self-hosted options is more important than Nexus's enterprise governance scope.

OWASP Threat Dragon is a free, open-source choice with no paid plans or stated usage limits.

pytm is a free option for teams wanting an OWASP-backed open-source approach.

ThreatForge offers a free Apache 2.0 application with no account required.

IriusRisk suits users wanting a freemium service whose Community Edition allows three active threat models and one user with limited collaboration.

Threagile is a free MIT-licensed open-source toolkit.

ThreatOpus fits teams seeking a paid monthly option with 15 users, ten workspaces, and 50 threat-model generations per month in its Starter plan.

ThreatTree is better for users who need a smaller freemium service, with a free tier capped at three forests, three DFDs per forest, and five attack trees per DFD.

See the broader Threat Modeling Software list for more options.

Verdict

Choose ThreatModeler Nexus if your organization needs threat modeling connected to architecture, compliance evidence, infrastructure changes, and developer workflows across a large portfolio. Its graph-based governance, broad methodology and compliance coverage, and regulated-environment credentials are the main reasons to choose it. Look elsewhere if you need a low-cost, short-term, or purely open-source tool, because the 4000.00 USD annual license, 12-month commitment, and possible AWS costs raise the entry bar.